Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 14 days ago

GRC and Vendor Risk Management

Whatfix31 open roles

Where
Bengaluru, Karnataka, India
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowGRC and Vendor Risk ManagementWhatfix · Bengaluru, Karnataka, India

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Whatfix's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. Whatfix postings stay open a median of 1 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 57.8%60 days
This job: posted 14 days ago

Whatfix median: 1 days open

The posting

Location: Bengaluru,Karnataka,India

Who are we?

Founded in 2014 by Khadim Batti and Vara Kumar, Whatfix is a leading global B2B SaaS provider and the largest pure-play enterprise digital adoption platform (DAP). Whatfix empowers companies to maximize the ROI of their digital investments across the application lifecycle, from ideation to training to the deployment of software. Driving user productivity, ensuring process compliance, and improving user experience of internal and customer-facing applications.

Spearheading the category with serial innovation and unmatched customer-centricity, Whatfix is the only DAP innovating beyond the category, positioning itself as a comprehensive suite for GenAI-powered digital adoption, analytics, and application simulation. Whatfix product suite consists of 3 products - DAP, Product Analytics, and Mirror. This product suite helps businesses accelerate ROI on digital investments by streamlining application deployment across its lifecycle.

Whatfix has seven offices across the US, India, UK, Germany, Singapore, and Australia and a presence across 40+ countries.

Customers: 700+ enterprise customers, including over 80 Fortune 500 companies such as Shell, Microsoft, Schneider Electric, and UPS Supply Chain Solutions.

Investors: Raised a total of ~$270 million. Most recently Series E round of $125 Million led by Warburg Pincus with participation from existing investor SoftBank Vision Fund 2. Other investors include Cisco Investments, Eight Roads Ventures (A division of Fidelity Investments), Dragoneer Investments, Peak XV Partners, and Stellaris Venture Partners.

  • With over 45% YoY sustainable annual recurring revenue (ARR) growth, Whatfix is among the “Top 50 Indian Software Companies” as per G2 Best Software Awards.
  • Recognized as a “Leader” in the digital adoption platforms (DAP) category for the past 4+ years by leading analyst firms like Gartner, Forrester, IDC, and Everest Group.
  • The only vendor recognized as a Customers’ Choice in the 2024 Gartner® Voice of the Customer for Digital Adoption Platforms has once again earned the Customers’ Choice distinction in 2025. We also boast a star rating of 4.6 on G2 Crowd, 4.5 on Gartner Peer Insights, and a high CSAT of 99.8%
  • Highest-Ranking DAP on 2023 Deloitte Technology Fast 500™ North America for Fourth Consecutive Year
  • Won the Silver for Stevie's Employer of the Year 2023 – Computer Software category and also recognized as Great Place to Work 2022-2023
  • Only DAP to be among the top 35% companies worldwide in sustainability excellence with EcoVadis Bronze Medal

On the G2 peer review platform, Whatfix has received 77 Leader badges across all market segments, including Small, Medium, and Enterprise, in 2024, among numerous other industry recognitions.

Role Summary:

We are looking for an Information Security – GRC Engineer to support and drive Whatfix's multi-framework compliance program across Information Security, Data Privacy, AI Governance, and Third-Party Risk Management (TPRM).

A key responsibility of this role will be to manage and operate the organization's end-to-end TPRM program, including vendor onboarding, risk assessments, due diligence, periodic reassessments, risk tracking, remediation, offboarding, and continuous improvement of the TPRM framework.

Roles & Resposblities:

Over all 3+ years of expereince in Third Party Risk Management

  • Manage and operate the end-to-end Third-Party Risk Management (TPRM) program, including vendor onboarding, risk classification, due diligence, security and privacy assessments, periodic reassessments, remediation tracking, and offboarding.
  • Conduct and coordinate third-party information security, privacy, compliance, and AI risk assessments.
  • Review vendor-provided evidence and artefacts, including security questionnaires, certifications, audit reports, policies, and other assurance documentation.
  • Identify, assess, document, and track risks associated with third-party relationships and follow up on mitigation and remediation actions.
  • Maintain accurate vendor inventories, assessment records, risk ratings, findings, exceptions, and reassessment schedules.
  • Manage and continuously monitor the vendor/TPRM management platform and related trackers to ensure records remain complete and up to date.
  • Coordinate with internal stakeholders and vendors throughout the third-party lifecycle.
  • Maintain and continuously improve TPRM policies, procedures, SOPs, risk assessment methodologies, and reporting.

GRC, Compliance & AI Governance

  • Support the implementation, maintenance, and continual improvement of compliance programs, including (but not limited to) ISO 27001, ISO 27701, ISO 42001, CSA STAR, TISAX, Cyber Essentials Plus, GDPR, DPDP, HIPAA, and other applicable requirements.
  • Manage day-to-day compliance activities, including GRC platforms, evidence collection, compliance trackers, stakeholder follow-ups, and SOPs.
  • Support internal and external audits, including audit preparation, evidence management, stakeholder coordination, and tracking observations and corrective actions.
  • Assist in conducting information security, privacy, compliance, and AI risk and impact assessments.
  • Support the organization's AI governance program, including maintaining the AI inventory and supporting AI risk assessments and governance activities.
  • Support periodic review and maintenance of Information Security, Privacy, AI, and other GRC-related policies and procedures.
  • Assist with security, privacy, and AI awareness initiatives.
  • Monitor relevant regulatory, security, privacy, and AI developments and support continuous improvement of GRC processes.
  • Manage and coordinate customer due-diligence requests, including security, privacy, compliance, and AI questionnaires, evidence requests, and stakeholder coordination.
  • Review information security, data privacy, and AI-related contractual requirements in customer and vendor agreements, including DPAs, security addendum, and other contractual obligations.

Functional Competencies:

  • Strong understanding of Third-Party Risk Management, including vendor lifecycle management, due diligence, risk assessments, evidence review, risk rating, remediation, and periodic reassessments.
  • Working knowledge of Information Security GRC, risk management, audits, and compliance management.
  • Familiarity with relevant standards and regulations, including ISO 27001, ISO 27701, ISO 42001, CSA STAR, TISAX, Cyber Essentials Plus, GDPR, DPDP, and HIPAA.
  • Understanding of AI governance, responsible AI, and AI risk/impact assessments.
  • Strong analytical, documentation, stakeholder management, communication, and follow-up skills.
  • Ability to manage multiple vendors, stakeholders, compliance activities, and deadlines with strong attention to detail.

Apply to this job

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Whatfix's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Whatfix's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Whatfix's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.